adam/metasploit-gs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
c3f5bd3de2d1affa01e2f6c2066c6bb0fc6413bc
metasploit-gs/api/Msf/Exploit/Remote/LDAP/ActiveDirectory.html
T
jenkins-metasploit c3f5bd3de2 Reboot gh-pages
2026-05-08 17:08:43 +00:00

2173 lines
124 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>
Module: Msf::Exploit::Remote::LDAP::ActiveDirectory
&mdash; Documentation by YARD 0.9.37
</title>
<link rel="stylesheet" href="../../../../css/style.css" type="text/css" />
<link rel="stylesheet" href="../../../../css/common.css" type="text/css" />
<script type="text/javascript">
pathId = "Msf::Exploit::Remote::LDAP::ActiveDirectory";
relpath = '../../../../';
</script>
<script type="text/javascript" charset="utf-8" src="../../../../js/jquery.js"></script>
<script type="text/javascript" charset="utf-8" src="../../../../js/app.js"></script>
</head>
<body>
<div class="nav_wrap">
<iframe id="nav" src="../../../../class_list.html?1"></iframe>
<div id="resizer"></div>
</div>
<div id="main" tabindex="-1">
<div id="header">
<div id="menu">
<a href="../../../../_index.html">Index (A)</a> &raquo;
<span class='title'><span class='object_link'><a href="../../../../Msf.html" title="Msf (module)">Msf</a></span></span> &raquo; <span class='title'><span class='object_link'><a href="../../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span> &raquo; <span class='title'><span class='object_link'><a href="../../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span> &raquo; <span class='title'><span class='object_link'><a href="../LDAP.html" title="Msf::Exploit::Remote::LDAP (module)">LDAP</a></span></span>
&raquo;
<span class="title">ActiveDirectory</span>
</div>
<div id="search">
<a class="full_list_link" id="class_list_link"
href="../../../../class_list.html">
<svg width="24" height="24">
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
</svg>
</a>
</div>
<div class="clear"></div>
</div>
<div id="content"><h1>Module: Msf::Exploit::Remote::LDAP::ActiveDirectory
</h1>
<div class="box_info">
<dl>
<dt>Includes:</dt>
<dd><span class='object_link'><a href="../LDAP.html" title="Msf::Exploit::Remote::LDAP (module)">Msf::Exploit::Remote::LDAP</a></span>, <span class='object_link'><a href="ActiveDirectory/SecurityDescriptorMatcher.html" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::SecurityDescriptorMatcher (module)">SecurityDescriptorMatcher</a></span>, <span class='object_link'><a href="EntryCache.html" title="Msf::Exploit::Remote::LDAP::EntryCache (module)">EntryCache</a></span></dd>
</dl>
<dl>
<dt>Defined in:</dt>
<dd>lib/msf/core/exploit/remote/ldap/active_directory/ad_cs_opts.rb<span class="defines">,<br />
lib/msf/core/exploit/remote/ldap/active_directory.rb,<br /> lib/msf/core/exploit/remote/ldap/active_directory/security_descriptor_matcher.rb</span>
</dd>
</dl>
</div>
<h2>Overview</h2><div class="docstring">
<div class="discussion">
<p>This module exposes methods for querying a remote LDAP service</p>
</div>
</div>
<div class="tags">
</div><h2>Defined Under Namespace</h2>
<p class="children">
<strong class="modules">Modules:</strong> <span class='object_link'><a href="ActiveDirectory/AdCsOpts.html" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::AdCsOpts (module)">AdCsOpts</a></span>, <span class='object_link'><a href="ActiveDirectory/SecurityDescriptorMatcher.html" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::SecurityDescriptorMatcher (module)">SecurityDescriptorMatcher</a></span>
</p>
<h2>
Constant Summary
<small><a href="#" class="constants_summary_toggle">collapse</a></small>
</h2>
<dl class="constants">
<dt id="LDAP_CAP_ACTIVE_DIRECTORY_OID-constant" class="">LDAP_CAP_ACTIVE_DIRECTORY_OID =
</dt>
<dd><pre class="code"><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>1.2.840.113556.1.4.800</span><span class='tstring_end'>&#39;</span></span><span class='period'>.</span><span class='id identifier rubyid_freeze'>freeze</span></pre></dd>
<dt id="LDAP_SERVER_SD_FLAGS_OID-constant" class="">LDAP_SERVER_SD_FLAGS_OID =
</dt>
<dd><pre class="code"><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>1.2.840.113556.1.4.801</span><span class='tstring_end'>&#39;</span></span><span class='period'>.</span><span class='id identifier rubyid_freeze'>freeze</span></pre></dd>
<dt id="OWNER_SECURITY_INFORMATION-constant" class="">OWNER_SECURITY_INFORMATION =
</dt>
<dd><pre class="code"><span class='int'>0x1</span></pre></dd>
<dt id="GROUP_SECURITY_INFORMATION-constant" class="">GROUP_SECURITY_INFORMATION =
</dt>
<dd><pre class="code"><span class='int'>0x2</span></pre></dd>
<dt id="DACL_SECURITY_INFORMATION-constant" class="">DACL_SECURITY_INFORMATION =
</dt>
<dd><pre class="code"><span class='int'>0x4</span></pre></dd>
<dt id="SACL_SECURITY_INFORMATION-constant" class="">SACL_SECURITY_INFORMATION =
</dt>
<dd><pre class="code"><span class='int'>0x8</span></pre></dd>
</dl>
<h3 class="inherited">Constants included
from <span class='object_link'><a href="ActiveDirectory/SecurityDescriptorMatcher.html" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::SecurityDescriptorMatcher (module)">SecurityDescriptorMatcher</a></span></h3>
<p class="inherited"><span class='object_link'><a href="ActiveDirectory/SecurityDescriptorMatcher.html#CERTIFICATE_AUTOENROLLMENT_EXTENDED_RIGHT-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::SecurityDescriptorMatcher::CERTIFICATE_AUTOENROLLMENT_EXTENDED_RIGHT (constant)">SecurityDescriptorMatcher::CERTIFICATE_AUTOENROLLMENT_EXTENDED_RIGHT</a></span>, <span class='object_link'><a href="ActiveDirectory/SecurityDescriptorMatcher.html#CERTIFICATE_ENROLLMENT_EXTENDED_RIGHT-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::SecurityDescriptorMatcher::CERTIFICATE_ENROLLMENT_EXTENDED_RIGHT (constant)">SecurityDescriptorMatcher::CERTIFICATE_ENROLLMENT_EXTENDED_RIGHT</a></span></p>
<h2>
Instance Method Summary
<small><a href="#" class="summary_toggle">collapse</a></small>
</h2>
<ul class="summary">
<li class="public ">
<span class="summary_signature">
<a href="#adds_build_ldap_sd_control-instance_method" title="#adds_build_ldap_sd_control (instance method)">#<strong>adds_build_ldap_sd_control</strong>(owner: true, group: true, dacl: true, sacl: false) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Build a control blob that will fetch all security descriptor data but the SACL.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_get_ca_servers-instance_method" title="#adds_get_ca_servers (instance method)">#<strong>adds_get_ca_servers</strong>(ldap) &#x21d2; Array&lt;Hash&gt; </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Query the LDAP server to retrieve all Certificate Authority (Enterprise CA) servers in the domain.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_get_current_user-instance_method" title="#adds_get_current_user (instance method)">#<strong>adds_get_current_user</strong>(ldap) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Get the LDAP object that describes the current user.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_get_domain_info-instance_method" title="#adds_get_domain_info (instance method)">#<strong>adds_get_domain_info</strong>(ldap) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Get the AD DS domain info for the current server.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_get_object_by_dn-instance_method" title="#adds_get_object_by_dn (instance method)">#<strong>adds_get_object_by_dn</strong>(ldap, object_dn) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Obtain a particular entity by its distinguished name (DN).</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_get_object_by_samaccountname-instance_method" title="#adds_get_object_by_samaccountname (instance method)">#<strong>adds_get_object_by_samaccountname</strong>(ldap, object_samaccountname) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Obtain a particular entity by its sAMAccountName.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_get_object_by_sid-instance_method" title="#adds_get_object_by_sid (instance method)">#<strong>adds_get_object_by_sid</strong>(ldap, object_sid) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Obtain a particular entity by its SID.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_obj_grants_permissions%3F-instance_method" title="#adds_obj_grants_permissions? (instance method)">#<strong>adds_obj_grants_permissions?</strong>(ldap, obj, matcher, test_sid: nil) &#x21d2; Boolean </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Determine if a security descriptor will grant the permissions identified by <strong>matcher</strong> to the <strong>test_sid</strong>.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_query_group_members-instance_method" title="#adds_query_group_members (instance method)">#<strong>adds_query_group_members</strong>(ldap, group_dn, base_dn: nil, inherited: true, object_class: nil) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Query LDAP and obtain all members of a particular group.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_query_member_groups-instance_method" title="#adds_query_member_groups (instance method)">#<strong>adds_query_member_groups</strong>(ldap, member_dn, base_dn: nil, inherited: true) &#x21d2; Object </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Query LDAP and obtain all groups a particular entity is a member of.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#adds_sd_grants_permissions%3F-instance_method" title="#adds_sd_grants_permissions? (instance method)">#<strong>adds_sd_grants_permissions?</strong>(ldap, security_descriptor, matcher, test_sid: nil, self_sid: nil) &#x21d2; Boolean </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Determine if a security descriptor will grant the permissions identified by <strong>matcher</strong> to the <strong>test_sid</strong>.</p>
</div></span>
</li>
<li class="public ">
<span class="summary_signature">
<a href="#is_active_directory%3F-instance_method" title="#is_active_directory? (instance method)">#<strong>is_active_directory?</strong>(ldap) &#x21d2; Boolean </a>
</span>
<span class="summary_desc"><div class='inline'>
<p>Query the remote server via the provided LDAP connection to determine if it’s an Active Directory LDAP server.</p>
</div></span>
</li>
</ul>
<h3 class="inherited">Methods included from <span class='object_link'><a href="EntryCache.html" title="Msf::Exploit::Remote::LDAP::EntryCache (module)">EntryCache</a></span></h3>
<p class="inherited"><span class='object_link'><a href="EntryCache.html#ldap_entry_cache-instance_method" title="Msf::Exploit::Remote::LDAP::EntryCache#ldap_entry_cache (method)">#ldap_entry_cache</a></span></p>
<h3 class="inherited">Methods included from <span class='object_link'><a href="../LDAP.html" title="Msf::Exploit::Remote::LDAP (module)">Msf::Exploit::Remote::LDAP</a></span></h3>
<p class="inherited"><span class='object_link'><a href="../LDAP.html#get_connect_opts-instance_method" title="Msf::Exploit::Remote::LDAP#get_connect_opts (method)">#get_connect_opts</a></span>, <span class='object_link'><a href="../LDAP.html#initialize-instance_method" title="Msf::Exploit::Remote::LDAP#initialize (method)">#initialize</a></span>, <span class='object_link'><a href="../LDAP.html#ldap_connect-instance_method" title="Msf::Exploit::Remote::LDAP#ldap_connect (method)">#ldap_connect</a></span>, <span class='object_link'><a href="../LDAP.html#ldap_escape_filter-instance_method" title="Msf::Exploit::Remote::LDAP#ldap_escape_filter (method)">#ldap_escape_filter</a></span>, <span class='object_link'><a href="../LDAP.html#ldap_new-instance_method" title="Msf::Exploit::Remote::LDAP#ldap_new (method)">#ldap_new</a></span>, <span class='object_link'><a href="../LDAP.html#ldap_open-instance_method" title="Msf::Exploit::Remote::LDAP#ldap_open (method)">#ldap_open</a></span>, <span class='object_link'><a href="../LDAP.html#peer-instance_method" title="Msf::Exploit::Remote::LDAP#peer (method)">#peer</a></span>, <span class='object_link'><a href="../LDAP.html#report_ldap_service-instance_method" title="Msf::Exploit::Remote::LDAP#report_ldap_service (method)">#report_ldap_service</a></span>, <span class='object_link'><a href="../LDAP.html#resolve_connect_opts-instance_method" title="Msf::Exploit::Remote::LDAP#resolve_connect_opts (method)">#resolve_connect_opts</a></span>, <span class='object_link'><a href="../LDAP.html#rhost-instance_method" title="Msf::Exploit::Remote::LDAP#rhost (method)">#rhost</a></span>, <span class='object_link'><a href="../LDAP.html#rport-instance_method" title="Msf::Exploit::Remote::LDAP#rport (method)">#rport</a></span>, <span class='object_link'><a href="../LDAP.html#ssl-instance_method" title="Msf::Exploit::Remote::LDAP#ssl (method)">#ssl</a></span>, <span class='object_link'><a href="../LDAP.html#validate_bind_success!-instance_method" title="Msf::Exploit::Remote::LDAP#validate_bind_success! (method)">#validate_bind_success!</a></span>, <span class='object_link'><a href="../LDAP.html#validate_query_result!-instance_method" title="Msf::Exploit::Remote::LDAP#validate_query_result! (method)">#validate_query_result!</a></span></p>
<h3 class="inherited">Methods included from <span class='object_link'><a href="../../../../Metasploit/Framework/LDAP/Client.html" title="Metasploit::Framework::LDAP::Client (module)">Metasploit::Framework::LDAP::Client</a></span></h3>
<p class="inherited"><span class='object_link'><a href="../../../../Metasploit/Framework/LDAP/Client.html#ldap_connect_opts-instance_method" title="Metasploit::Framework::LDAP::Client#ldap_connect_opts (method)">#ldap_connect_opts</a></span></p>
<h3 class="inherited">Methods included from <span class='object_link'><a href="../Kerberos/ServiceAuthenticator/Options.html" title="Msf::Exploit::Remote::Kerberos::ServiceAuthenticator::Options (module)">Kerberos::ServiceAuthenticator::Options</a></span></h3>
<p class="inherited"><span class='object_link'><a href="../Kerberos/ServiceAuthenticator/Options.html#kerberos_auth_options-instance_method" title="Msf::Exploit::Remote::Kerberos::ServiceAuthenticator::Options#kerberos_auth_options (method)">#kerberos_auth_options</a></span>, <span class='object_link'><a href="../Kerberos/ServiceAuthenticator/Options.html#kerberos_clock_skew_seconds-instance_method" title="Msf::Exploit::Remote::Kerberos::ServiceAuthenticator::Options#kerberos_clock_skew_seconds (method)">#kerberos_clock_skew_seconds</a></span></p>
<h3 class="inherited">Methods included from <span class='object_link'><a href="../Kerberos/Ticket/Storage.html" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage (module)">Kerberos::Ticket::Storage</a></span></h3>
<p class="inherited"><span class='object_link'><a href="../Kerberos/Ticket/Storage.html#initialize-instance_method" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage#initialize (method)">#initialize</a></span>, <span class='object_link'><a href="../Kerberos/Ticket/Storage.html#kerberos_storage_options-instance_method" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage#kerberos_storage_options (method)">#kerberos_storage_options</a></span>, <span class='object_link'><a href="../Kerberos/Ticket/Storage.html#kerberos_ticket_storage-instance_method" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage#kerberos_ticket_storage (method)">#kerberos_ticket_storage</a></span>, <span class='object_link'><a href="../Kerberos/Ticket/Storage.html#store_ccache-class_method" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage.store_ccache (method)">store_ccache</a></span></p>
<div id="instance_method_details" class="method_details_list">
<h2>Instance Method Details</h2>
<div class="method_details first">
<h3 class="signature first" id="adds_build_ldap_sd_control-instance_method">
#<strong>adds_build_ldap_sd_control</strong>(owner: true, group: true, dacl: true, sacl: false) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Build a control blob that will fetch all security descriptor data but the SACL. This often enables reading a security descriptor’s DACL without the need for elevated permissions.</p>
</div>
</div>
<div class="tags">
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 44</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_build_ldap_sd_control'>adds_build_ldap_sd_control</span><span class='lparen'>(</span><span class='label'>owner:</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='label'>group:</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='label'>dacl:</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='label'>sacl:</span> <span class='kw'>false</span><span class='rparen'>)</span>
<span class='comment'># Set the value of LDAP_SERVER_SD_FLAGS_OID flag so everything but
</span> <span class='comment'># the SACL flag is set, as we need administrative privileges to retrieve
</span> <span class='comment'># the SACL from the ntSecurityDescriptor attribute on Windows AD LDAP servers.
</span> <span class='comment'>#
</span> <span class='comment'># Note that without specifying the LDAP_SERVER_SD_FLAGS_OID control in this manner,
</span> <span class='comment'># the LDAP searchRequest will default to trying to grab all possible attributes of
</span> <span class='comment'># the ntSecurityDescriptor attribute, hence resulting in an attempt to retrieve the
</span> <span class='comment'># SACL even if the user is not an administrative user.
</span> <span class='comment'>#
</span> <span class='comment'># Now one may think that we would just get the rest of the data without the SACL field,
</span> <span class='comment'># however in reality LDAP will cause that attribute to just be blanked out if a part of it
</span> <span class='comment'># cannot be retrieved, so we just will get nothing for the ntSecurityDescriptor attribute
</span> <span class='comment'># in these cases if the user doesn&#39;t have permissions to read the SACL.
</span> <span class='id identifier rubyid_flags'>flags</span> <span class='op'>=</span> <span class='int'>0</span>
<span class='id identifier rubyid_flags'>flags</span> <span class='op'>|=</span> <span class='const'><span class='object_link'><a href="#OWNER_SECURITY_INFORMATION-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::OWNER_SECURITY_INFORMATION (constant)">OWNER_SECURITY_INFORMATION</a></span></span> <span class='kw'>if</span> <span class='id identifier rubyid_owner'>owner</span>
<span class='id identifier rubyid_flags'>flags</span> <span class='op'>|=</span> <span class='const'><span class='object_link'><a href="#GROUP_SECURITY_INFORMATION-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::GROUP_SECURITY_INFORMATION (constant)">GROUP_SECURITY_INFORMATION</a></span></span> <span class='kw'>if</span> <span class='id identifier rubyid_group'>group</span>
<span class='id identifier rubyid_flags'>flags</span> <span class='op'>|=</span> <span class='const'><span class='object_link'><a href="#DACL_SECURITY_INFORMATION-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::DACL_SECURITY_INFORMATION (constant)">DACL_SECURITY_INFORMATION</a></span></span> <span class='kw'>if</span> <span class='id identifier rubyid_dacl'>dacl</span>
<span class='id identifier rubyid_flags'>flags</span> <span class='op'>|=</span> <span class='const'><span class='object_link'><a href="#SACL_SECURITY_INFORMATION-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::SACL_SECURITY_INFORMATION (constant)">SACL_SECURITY_INFORMATION</a></span></span> <span class='kw'>if</span> <span class='id identifier rubyid_sacl'>sacl</span>
<span class='id identifier rubyid_control_values'>control_values</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='id identifier rubyid_flags'>flags</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span><span class='lparen'>(</span><span class='op'>&amp;</span><span class='symbol'>:to_ber</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_to_ber_sequence'>to_ber_sequence</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='period'>.</span><span class='id identifier rubyid_to_ber'>to_ber</span>
<span class='lbracket'>[</span><span class='const'><span class='object_link'><a href="#LDAP_SERVER_SD_FLAGS_OID-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::LDAP_SERVER_SD_FLAGS_OID (constant)">LDAP_SERVER_SD_FLAGS_OID</a></span></span><span class='period'>.</span><span class='id identifier rubyid_to_ber'>to_ber</span><span class='comma'>,</span> <span class='kw'>true</span><span class='period'>.</span><span class='id identifier rubyid_to_ber'>to_ber</span><span class='comma'>,</span> <span class='id identifier rubyid_control_values'>control_values</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_to_ber_sequence'>to_ber_sequence</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_get_ca_servers-instance_method">
#<strong>adds_get_ca_servers</strong>(ldap) &#x21d2; <tt>Array&lt;Hash&gt;</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Query the LDAP server to retrieve all Certificate Authority (Enterprise CA) servers in the domain.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
</ul>
<p class="tag_title">Returns:</p>
<ul class="return">
<li>
<span class='type'>(<tt>Array&lt;Hash&gt;</tt>)</span>
&mdash;
<div class='inline'>
<p>An array of hashes, where each hash contains the ‘:name` and `:dNSHostName` of a CA server.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 277</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_get_ca_servers'>adds_get_ca_servers</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='rparen'>)</span>
<span class='id identifier rubyid_base_dn'>base_dn</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,</span><span class='embexpr_beg'>#{</span><span class='ivar'>@base_dn</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span>
<span class='id identifier rubyid_filter'>filter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>(objectClass=pKIEnrollmentService)</span><span class='tstring_end'>&#39;</span></span>
<span class='id identifier rubyid_attributes'>attributes</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>cn</span><span class='tstring_end'>&#39;</span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>dNSHostName</span><span class='tstring_end'>&#39;</span></span><span class='rbracket'>]</span>
<span class='id identifier rubyid_ca_servers'>ca_servers</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
<span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span><span class='label'>base:</span> <span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span> <span class='label'>filter:</span> <span class='id identifier rubyid_filter'>filter</span><span class='comma'>,</span> <span class='label'>attributes:</span> <span class='id identifier rubyid_attributes'>attributes</span><span class='rparen'>)</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_entry'>entry</span><span class='op'>|</span>
<span class='id identifier rubyid_ca_servers'>ca_servers</span> <span class='op'>&lt;&lt;</span> <span class='lbrace'>{</span>
<span class='label'>name:</span> <span class='id identifier rubyid_entry'>entry</span><span class='lbracket'>[</span><span class='symbol'>:cn</span><span class='rbracket'>]</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span><span class='comma'>,</span>
<span class='label'>dNSHostName:</span> <span class='id identifier rubyid_entry'>entry</span><span class='lbracket'>[</span><span class='symbol'>:dNSHostName</span><span class='rbracket'>]</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='rbrace'>}</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_ca_servers'>ca_servers</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_get_current_user-instance_method">
#<strong>adds_get_current_user</strong>(ldap) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Get the LDAP object that describes the current user.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
229
230
231
232
233
234
235</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 229</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_get_current_user'>adds_get_current_user</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='rparen'>)</span>
<span class='id identifier rubyid_whoami'>whoami</span> <span class='op'>=</span> <span class='ivar'>@ldap_whoami</span> <span class='op'>=</span> <span class='lparen'>(</span><span class='ivar'>@ldap_whoami</span> <span class='op'>||</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_ldapwhoami'>ldapwhoami</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='rparen'>)</span>
<span class='id identifier rubyid_our_domain'>our_domain</span><span class='comma'>,</span> <span class='id identifier rubyid__'>_</span><span class='comma'>,</span> <span class='id identifier rubyid_our_username'>our_username</span> <span class='op'>=</span> <span class='id identifier rubyid_whoami'>whoami</span><span class='period'>.</span><span class='id identifier rubyid_delete_prefix'>delete_prefix</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>u:</span><span class='tstring_end'>&#39;</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_partition'>partition</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>\\</span><span class='tstring_end'>&#39;</span></span><span class='rparen'>)</span>
<span class='comment'># todo: this is probably going to have issues if our user is from a domain that the target server is not the
</span> <span class='comment'># authority of
</span> <span class='id identifier rubyid_adds_get_object_by_samaccountname'>adds_get_object_by_samaccountname</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_our_username'>our_username</span><span class='rparen'>)</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_get_domain_info-instance_method">
#<strong>adds_get_domain_info</strong>(ldap) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Get the AD DS domain info for the current server.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 241</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_get_domain_info'>adds_get_domain_info</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='rparen'>)</span>
<span class='id identifier rubyid_domain_object'>domain_object</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span><span class='label'>base:</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span> <span class='label'>filter:</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>(objectClass=domain)</span><span class='tstring_end'>&#39;</span></span><span class='comma'>,</span> <span class='label'>return_result:</span> <span class='kw'>true</span><span class='rparen'>)</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='kw'>return</span> <span class='kw'>nil</span> <span class='kw'>unless</span> <span class='id identifier rubyid_domain_object'>domain_object</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span> <span class='op'>&lt;&lt;</span> <span class='id identifier rubyid_domain_object'>domain_object</span>
<span class='id identifier rubyid_domain_sid'>domain_sid</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_domain_object'>domain_object</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span>
<span class='id identifier rubyid_domain_behavior_version'>domain_behavior_version</span> <span class='op'>=</span> <span class='id identifier rubyid_domain_object'>domain_object</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>msds-behavior-version</span><span class='tstring_end'>&#39;</span></span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
<span class='id identifier rubyid_root_dse'>root_dse</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span>
<span class='label'>base:</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_end'>&#39;</span></span><span class='comma'>,</span>
<span class='label'>scope:</span> <span class='const'>Net</span><span class='op'>::</span><span class='const'>LDAP</span><span class='op'>::</span><span class='const'>SearchScope_BaseObject</span><span class='comma'>,</span>
<span class='label'>attributes:</span> <span class='qsymbols_beg'>%i[</span><span class='tstring_content'>configurationNamingContext</span><span class='tstring_end'>]</span></span>
<span class='rparen'>)</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='kw'>return</span> <span class='kw'>nil</span> <span class='kw'>unless</span> <span class='id identifier rubyid_root_dse'>root_dse</span>
<span class='id identifier rubyid_xrefs'>xrefs</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span>
<span class='label'>base:</span> <span class='id identifier rubyid_root_dse'>root_dse</span><span class='lbracket'>[</span><span class='symbol'>:configurationNamingContext</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='comma'>,</span>
<span class='label'>filter:</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>(&amp;(objectCategory=crossref)(nETBIOSName=*)(nCName=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_base_dn'>base_dn</span><span class='embexpr_end'>}</span><span class='tstring_content'>))</span><span class='tstring_end'>&quot;</span></span>
<span class='rparen'>)</span>
<span class='kw'>return</span> <span class='kw'>nil</span> <span class='kw'>unless</span> <span class='id identifier rubyid_xrefs'>xrefs</span><span class='op'>&amp;.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>==</span> <span class='int'>1</span>
<span class='id identifier rubyid_xref'>xref</span> <span class='op'>=</span> <span class='id identifier rubyid_xrefs'>xrefs</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span> <span class='op'>&lt;&lt;</span> <span class='id identifier rubyid_xref'>xref</span>
<span class='lbrace'>{</span>
<span class='label'>domain_behavior_version:</span> <span class='id identifier rubyid_domain_behavior_version'>domain_behavior_version</span><span class='period'>.</span><span class='id identifier rubyid_to_i'>to_i</span><span class='comma'>,</span>
<span class='label'>netbios_name:</span> <span class='id identifier rubyid_xref'>xref</span><span class='lbracket'>[</span><span class='symbol'>:nETBIOSName</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='comma'>,</span>
<span class='label'>dns_name:</span> <span class='id identifier rubyid_xref'>xref</span><span class='lbracket'>[</span><span class='symbol'>:dNSRoot</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='comma'>,</span>
<span class='label'>sid:</span> <span class='id identifier rubyid_domain_sid'>domain_sid</span>
<span class='rbrace'>}</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_get_object_by_dn-instance_method">
#<strong>adds_get_object_by_dn</strong>(ldap, object_dn) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Obtain a particular entity by its distinguished name (DN).</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
<li>
<span class='name'>object_dn</span>
<span class='type'>(<tt>String</tt>)</span>
&mdash;
<div class='inline'>
<p>The full distinguished name of the object to retrieve.</p>
</div>
</li>
</ul>
<p class="tag_title">Returns:</p>
<ul class="return">
<li>
<span class='type'></span>
<div class='inline'>
<p>Returns nil when the object was not found.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 157</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_get_object_by_dn'>adds_get_object_by_dn</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_object_dn'>object_dn</span><span class='rparen'>)</span>
<span class='id identifier rubyid_object'>object</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_get_by_dn'>get_by_dn</span><span class='lparen'>(</span><span class='id identifier rubyid_object_dn'>object_dn</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='kw'>nil</span> <span class='kw'>if</span> <span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_missing_entry?'>missing_entry?</span><span class='lparen'>(</span><span class='id identifier rubyid_object'>object</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='id identifier rubyid_object'>object</span> <span class='kw'>if</span> <span class='id identifier rubyid_object'>object</span>
<span class='id identifier rubyid_object'>object</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span><span class='label'>base:</span> <span class='id identifier rubyid_object_dn'>object_dn</span><span class='comma'>,</span> <span class='label'>controls:</span> <span class='lbracket'>[</span><span class='id identifier rubyid_adds_build_ldap_sd_control'>adds_build_ldap_sd_control</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='label'>scope:</span> <span class='const'>Net</span><span class='op'>::</span><span class='const'>LDAP</span><span class='op'>::</span><span class='const'>SearchScope_BaseObject</span><span class='rparen'>)</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='id identifier rubyid_validate_query_result!'>validate_query_result!</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_get_operation_result'>get_operation_result</span><span class='period'>.</span><span class='id identifier rubyid_table'>table</span><span class='rparen'>)</span>
<span class='kw'>if</span> <span class='id identifier rubyid_object'>object</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span> <span class='op'>&lt;&lt;</span> <span class='id identifier rubyid_object'>object</span>
<span class='kw'>else</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_mark_missing_by_dn'>mark_missing_by_dn</span><span class='lparen'>(</span><span class='id identifier rubyid_object_dn'>object_dn</span><span class='rparen'>)</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_object'>object</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_get_object_by_samaccountname-instance_method">
#<strong>adds_get_object_by_samaccountname</strong>(ldap, object_samaccountname) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Obtain a particular entity by its sAMAccountName.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
<li>
<span class='name'>object_samaccountname</span>
<span class='type'>(<tt>String</tt>)</span>
&mdash;
<div class='inline'>
<p>The sAMAccountName of the object to retrieve.</p>
</div>
</li>
</ul>
<p class="tag_title">Returns:</p>
<ul class="return">
<li>
<span class='type'></span>
<div class='inline'>
<p>Returns nil when the object was not found.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 179</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_get_object_by_samaccountname'>adds_get_object_by_samaccountname</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_object_samaccountname'>object_samaccountname</span><span class='rparen'>)</span>
<span class='id identifier rubyid_object'>object</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_get_by_samaccountname'>get_by_samaccountname</span><span class='lparen'>(</span><span class='id identifier rubyid_object_samaccountname'>object_samaccountname</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='kw'>nil</span> <span class='kw'>if</span> <span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_missing_entry?'>missing_entry?</span><span class='lparen'>(</span><span class='id identifier rubyid_object'>object</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='id identifier rubyid_object'>object</span> <span class='kw'>if</span> <span class='id identifier rubyid_object'>object</span>
<span class='id identifier rubyid_filter'>filter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>(sAMAccountName=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap_escape_filter'>ldap_escape_filter</span><span class='lparen'>(</span><span class='id identifier rubyid_object_samaccountname'>object_samaccountname</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>&quot;</span></span>
<span class='kw'>begin</span>
<span class='id identifier rubyid_object'>object</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span><span class='label'>base:</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span> <span class='label'>controls:</span> <span class='lbracket'>[</span><span class='id identifier rubyid_adds_build_ldap_sd_control'>adds_build_ldap_sd_control</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='label'>filter:</span> <span class='id identifier rubyid_filter'>filter</span><span class='rparen'>)</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='kw'>rescue</span> <span class='const'>Net</span><span class='op'>::</span><span class='const'>LDAP</span><span class='op'>::</span><span class='const'>Error</span> <span class='op'>=&gt;</span> <span class='id identifier rubyid_e'>e</span>
<span class='id identifier rubyid_elog'><span class='object_link'><a href="../../../../top-level-namespace.html#elog-instance_method" title="#elog (method)">elog</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>ldap search error for sAMAccountName</span><span class='tstring_end'>&#39;</span></span><span class='comma'>,</span> <span class='label'>error:</span> <span class='id identifier rubyid_e'>e</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='kw'>nil</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_validate_query_result!'>validate_query_result!</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_get_operation_result'>get_operation_result</span><span class='period'>.</span><span class='id identifier rubyid_table'>table</span><span class='comma'>,</span> <span class='id identifier rubyid_filter'>filter</span><span class='rparen'>)</span>
<span class='kw'>if</span> <span class='id identifier rubyid_object'>object</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span> <span class='op'>&lt;&lt;</span> <span class='id identifier rubyid_object'>object</span>
<span class='kw'>else</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_mark_missing_by_samaccountname'>mark_missing_by_samaccountname</span><span class='lparen'>(</span><span class='id identifier rubyid_object_samaccountname'>object_samaccountname</span><span class='rparen'>)</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_object'>object</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_get_object_by_sid-instance_method">
#<strong>adds_get_object_by_sid</strong>(ldap, object_sid) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Obtain a particular entity by its SID.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
<li>
<span class='name'>object_sid</span>
<span class='type'>(<tt>String</tt>)</span>
&mdash;
<div class='inline'>
<p>The SID of the object to retrieve.</p>
</div>
</li>
</ul>
<p class="tag_title">Returns:</p>
<ul class="return">
<li>
<span class='type'></span>
<div class='inline'>
<p>Returns nil when the object was not found.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 207</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_get_object_by_sid'>adds_get_object_by_sid</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_object_sid'>object_sid</span><span class='rparen'>)</span>
<span class='id identifier rubyid_object_sid'>object_sid</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='id identifier rubyid_object_sid'>object_sid</span><span class='rparen'>)</span>
<span class='id identifier rubyid_object'>object</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_get_by_sid'>get_by_sid</span><span class='lparen'>(</span><span class='id identifier rubyid_object_sid'>object_sid</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='kw'>nil</span> <span class='kw'>if</span> <span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_missing_entry?'>missing_entry?</span><span class='lparen'>(</span><span class='id identifier rubyid_object'>object</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='id identifier rubyid_object'>object</span> <span class='kw'>if</span> <span class='id identifier rubyid_object'>object</span>
<span class='id identifier rubyid_filter'>filter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>(objectSID=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap_escape_filter'>ldap_escape_filter</span><span class='lparen'>(</span><span class='id identifier rubyid_object_sid'>object_sid</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>&quot;</span></span>
<span class='id identifier rubyid_object'>object</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span><span class='label'>base:</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span> <span class='label'>controls:</span> <span class='lbracket'>[</span><span class='id identifier rubyid_adds_build_ldap_sd_control'>adds_build_ldap_sd_control</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='label'>filter:</span> <span class='id identifier rubyid_filter'>filter</span><span class='rparen'>)</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='id identifier rubyid_validate_query_result!'>validate_query_result!</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_get_operation_result'>get_operation_result</span><span class='period'>.</span><span class='id identifier rubyid_table'>table</span><span class='comma'>,</span> <span class='id identifier rubyid_filter'>filter</span><span class='rparen'>)</span>
<span class='kw'>if</span> <span class='id identifier rubyid_object'>object</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span> <span class='op'>&lt;&lt;</span> <span class='id identifier rubyid_object'>object</span>
<span class='kw'>else</span>
<span class='id identifier rubyid_ldap_entry_cache'>ldap_entry_cache</span><span class='period'>.</span><span class='id identifier rubyid_mark_missing_by_sid'>mark_missing_by_sid</span><span class='lparen'>(</span><span class='id identifier rubyid_object_sid'>object_sid</span><span class='rparen'>)</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_object'>object</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_obj_grants_permissions?-instance_method">
#<strong>adds_obj_grants_permissions?</strong>(ldap, obj, matcher, test_sid: nil) &#x21d2; <tt>Boolean</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Determine if a security descriptor will grant the permissions identified by <strong>matcher</strong> to the <strong>test_sid</strong>. For this to work, the authenticated user typically needs “Read permissions”, and “Read general information” from the advanced “Permission Entry” form in Active Directory. The more generic, “Read properties” permission will also do the trick.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
<li>
<span class='name'>obj</span>
<span class='type'>(<tt>Net::LDAP::Entry</tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP object to test. The security descriptor will be taken from the nTSecurityDescriptor attribute.</p>
</div>
</li>
<li>
<span class='name'>matcher</span>
<span class='type'>(<tt>#call</tt>)</span>
&mdash;
<div class='inline'>
<p>An object that will match ACEs that allow or deny the desired permissions.</p>
</div>
</li>
<li>
<span class='name'>test_sid</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">Rex::Proto::MsDtyp::MsDtypSid</a></span></tt>)</span>
<em class="default">(defaults to: <tt>nil</tt>)</em>
&mdash;
<div class='inline'>
<p>The SID to check for access.</p>
</div>
</li>
</ul>
<p class="tag_title">Returns:</p>
<ul class="return">
<li>
<span class='type'>(<tt>Boolean</tt>)</span>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
385
386
387
388
389
390
391
392
393
394
395
396
397</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 385</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_obj_grants_permissions?'>adds_obj_grants_permissions?</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_obj'>obj</span><span class='comma'>,</span> <span class='id identifier rubyid_matcher'>matcher</span><span class='comma'>,</span> <span class='label'>test_sid:</span> <span class='kw'>nil</span><span class='rparen'>)</span>
<span class='kw'>unless</span> <span class='id identifier rubyid_obj'>obj</span><span class='lbracket'>[</span><span class='symbol'>:nTSecurityDescriptor</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span>
<span class='id identifier rubyid_raise'>raise</span> <span class='const'>RuntimeError</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>The nTSecurityDescriptor can not be read from the object.</span><span class='tstring_end'>&#39;</span></span><span class='rparen'>)</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_security_descriptor'>security_descriptor</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSecurityDescriptor.html" title="Rex::Proto::MsDtyp::MsDtypSecurityDescriptor (class)">MsDtypSecurityDescriptor</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_obj'>obj</span><span class='lbracket'>[</span><span class='symbol'>:nTSecurityDescriptor</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span>
<span class='id identifier rubyid_self_sid'>self_sid</span> <span class='op'>=</span> <span class='kw'>nil</span>
<span class='kw'>if</span> <span class='id identifier rubyid_obj'>obj</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='id identifier rubyid_self_sid'>self_sid</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_obj'>obj</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_adds_sd_grants_permissions?'>adds_sd_grants_permissions?</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_security_descriptor'>security_descriptor</span><span class='comma'>,</span> <span class='id identifier rubyid_matcher'>matcher</span><span class='comma'>,</span> <span class='label'>test_sid:</span> <span class='id identifier rubyid_test_sid'>test_sid</span><span class='comma'>,</span> <span class='label'>self_sid:</span> <span class='id identifier rubyid_self_sid'>self_sid</span><span class='rparen'>)</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_query_group_members-instance_method">
#<strong>adds_query_group_members</strong>(ldap, group_dn, base_dn: nil, inherited: true, object_class: nil) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Query LDAP and obtain all members of a particular group. In this context, “members” are either users or groups.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
<li>
<span class='name'>group_dn</span>
<span class='type'>(<tt>String</tt>)</span>
&mdash;
<div class='inline'>
<p>The DN of the group to obtain members for.</p>
</div>
</li>
<li>
<span class='name'>base_dn</span>
<span class='type'>(<tt>String</tt>)</span>
<em class="default">(defaults to: <tt>nil</tt>)</em>
&mdash;
<div class='inline'>
<p>An optional base search DN.</p>
</div>
</li>
<li>
<span class='name'>inherited</span>
<span class='type'>(<tt>Boolean</tt>)</span>
<em class="default">(defaults to: <tt>true</tt>)</em>
&mdash;
<div class='inline'>
<p>Whether or not to include entities that are members by inheritance.</p>
</div>
</li>
<li>
<span class='name'>object_class</span>
<span class='type'>(<tt>String</tt>)</span>
<em class="default">(defaults to: <tt>nil</tt>)</em>
&mdash;
<div class='inline'>
<p>An optional object class for filtering. This is typically either ‘user’ or ‘group’.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 74</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_query_group_members'>adds_query_group_members</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_group_dn'>group_dn</span><span class='comma'>,</span> <span class='label'>base_dn:</span> <span class='kw'>nil</span><span class='comma'>,</span> <span class='label'>inherited:</span> <span class='kw'>true</span><span class='comma'>,</span> <span class='label'>object_class:</span> <span class='kw'>nil</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='id identifier rubyid_enum_for'>enum_for</span><span class='lparen'>(</span><span class='symbol'>:adds_query_group_members</span><span class='comma'>,</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_group_dn'>group_dn</span><span class='comma'>,</span> <span class='label'>base_dn:</span> <span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span> <span class='label'>inherited:</span> <span class='id identifier rubyid_inherited'>inherited</span><span class='comma'>,</span> <span class='label'>object_class:</span> <span class='id identifier rubyid_object_class'>object_class</span><span class='rparen'>)</span> <span class='kw'>unless</span> <span class='id identifier rubyid_block_given?'>block_given?</span>
<span class='id identifier rubyid_results'>results</span> <span class='op'>=</span> <span class='int'>0</span>
<span class='id identifier rubyid_member_filter'>member_filter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>memberOf</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_inherited'>inherited</span> <span class='op'>?</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>:1.2.840.113556.1.4.1941:</span><span class='tstring_end'>&#39;</span></span> <span class='op'>:</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_end'>&#39;</span></span><span class='embexpr_end'>}</span><span class='tstring_content'>=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap_escape_filter'>ldap_escape_filter</span><span class='lparen'>(</span><span class='id identifier rubyid_group_dn'>group_dn</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span>
<span class='comment'># Get the member&#39;s primaryGroupID
</span> <span class='id identifier rubyid_group'>group</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_get_object_by_dn'>adds_get_object_by_dn</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_group_dn'>group_dn</span><span class='rparen'>)</span>
<span class='kw'>if</span> <span class='id identifier rubyid_group'>group</span> <span class='op'>&amp;&amp;</span> <span class='id identifier rubyid_group'>group</span><span class='lbracket'>[</span><span class='symbol'>:objectSID</span><span class='rbracket'>]</span>
<span class='id identifier rubyid_group_sid'>group_sid</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_group'>group</span><span class='lbracket'>[</span><span class='symbol'>:objectSID</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span>
<span class='comment'># if we have a group RID, filter on that when the object has it as it&#39;s primaryGroupId to include those groups too
</span> <span class='id identifier rubyid_member_filter'>member_filter</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>|(</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_member_filter'>member_filter</span><span class='embexpr_end'>}</span><span class='tstring_content'>)(primaryGroupId=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_group_sid'>group_sid</span><span class='period'>.</span><span class='id identifier rubyid_rid'>rid</span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>&quot;</span></span>
<span class='kw'>end</span>
<span class='id identifier rubyid_filters'>filters</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
<span class='id identifier rubyid_filters'>filters</span> <span class='op'>&lt;&lt;</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>objectClass=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap_escape_filter'>ldap_escape_filter</span><span class='lparen'>(</span><span class='id identifier rubyid_object_class'>object_class</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span> <span class='kw'>if</span> <span class='id identifier rubyid_object_class'>object_class</span>
<span class='id identifier rubyid_filters'>filters</span> <span class='op'>&lt;&lt;</span> <span class='id identifier rubyid_member_filter'>member_filter</span>
<span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span>
<span class='label'>base:</span> <span class='id identifier rubyid_base_dn'>base_dn</span> <span class='op'>||</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span>
<span class='label'>controls:</span> <span class='lbracket'>[</span><span class='id identifier rubyid_adds_build_ldap_sd_control'>adds_build_ldap_sd_control</span><span class='rbracket'>]</span><span class='comma'>,</span>
<span class='label'>filter:</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>(&amp;</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_filters'>filters</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span> <span class='lbrace'>{</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>(</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid__1'>_1</span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>&quot;</span></span> <span class='rbrace'>}</span><span class='period'>.</span><span class='id identifier rubyid_join'><span class='object_link'><a href="../../../../top-level-namespace.html#join-instance_method" title="#join (method)">join</a></span></span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>&quot;</span></span><span class='comma'>,</span>
<span class='label'>return_result:</span> <span class='kw'>false</span> <span class='comment'># make sure we&#39;re streaming because this could be a lot of data
</span> <span class='rparen'>)</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_ldap_entry'>ldap_entry</span><span class='op'>|</span>
<span class='kw'>yield</span> <span class='id identifier rubyid_ldap_entry'>ldap_entry</span>
<span class='id identifier rubyid_results'>results</span> <span class='op'>+=</span> <span class='int'>1</span>
<span class='kw'>end</span>
<span class='kw'>unless</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_get_operation_result'>get_operation_result</span><span class='period'>.</span><span class='id identifier rubyid_code'>code</span> <span class='op'>==</span> <span class='int'>0</span>
<span class='id identifier rubyid_raise'>raise</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>LDAP Error: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_get_operation_result'>get_operation_result</span><span class='period'>.</span><span class='id identifier rubyid_message'>message</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span>
<span class='kw'>end</span>
<span class='id identifier rubyid_results'>results</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_query_member_groups-instance_method">
#<strong>adds_query_member_groups</strong>(ldap, member_dn, base_dn: nil, inherited: true) &#x21d2; <tt>Object</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Query LDAP and obtain all groups a particular entity is a member of. In this context, “members” are either users or groups.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
<li>
<span class='name'>member_dn</span>
<span class='type'>(<tt>String</tt>)</span>
&mdash;
<div class='inline'>
<p>The DN of the member to obtain groups for.</p>
</div>
</li>
<li>
<span class='name'>base_dn</span>
<span class='type'>(<tt>String</tt>)</span>
<em class="default">(defaults to: <tt>nil</tt>)</em>
&mdash;
<div class='inline'>
<p>An optional base search DN.</p>
</div>
</li>
<li>
<span class='name'>inherited</span>
<span class='type'>(<tt>Boolean</tt>)</span>
<em class="default">(defaults to: <tt>true</tt>)</em>
&mdash;
<div class='inline'>
<p>Whether or not to include groups that are inherited.</p>
</div>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 115</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_query_member_groups'>adds_query_member_groups</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_member_dn'>member_dn</span><span class='comma'>,</span> <span class='label'>base_dn:</span> <span class='kw'>nil</span><span class='comma'>,</span> <span class='label'>inherited:</span> <span class='kw'>true</span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='id identifier rubyid_enum_for'>enum_for</span><span class='lparen'>(</span><span class='symbol'>:adds_query_member_groups</span><span class='comma'>,</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_member_dn'>member_dn</span><span class='comma'>,</span> <span class='label'>base_dn:</span> <span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span> <span class='label'>inherited:</span> <span class='id identifier rubyid_inherited'>inherited</span><span class='rparen'>)</span> <span class='kw'>unless</span> <span class='id identifier rubyid_block_given?'>block_given?</span>
<span class='id identifier rubyid_results'>results</span> <span class='op'>=</span> <span class='int'>0</span>
<span class='comment'># Get the member&#39;s primaryGroupId
</span> <span class='id identifier rubyid_member'>member</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_get_object_by_dn'>adds_get_object_by_dn</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_member_dn'>member_dn</span><span class='rparen'>)</span>
<span class='kw'>if</span> <span class='id identifier rubyid_member'>member</span> <span class='op'>&amp;&amp;</span> <span class='id identifier rubyid_member'>member</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span> <span class='op'>&amp;&amp;</span> <span class='id identifier rubyid_member'>member</span><span class='lbracket'>[</span><span class='symbol'>:primaryGroupId</span><span class='rbracket'>]</span> <span class='op'>&amp;&amp;</span> <span class='op'>!</span><span class='id identifier rubyid_member'>member</span><span class='lbracket'>[</span><span class='symbol'>:primaryGroupId</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_empty?'>empty?</span>
<span class='comment'># if it&#39;s found, calculate the SID of the primary group and query it, the primary group is typically &#39;Domain Users&#39;
</span> <span class='comment'># and is *not* included in the member query
</span> <span class='id identifier rubyid_member_sid'>member_sid</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_member'>member</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span>
<span class='id identifier rubyid_primary_group_sid'>primary_group_sid</span> <span class='op'>=</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_member_sid'>member_sid</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='period'>.</span><span class='id identifier rubyid_rpartition'>rpartition</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>-</span><span class='tstring_end'>&#39;</span></span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='embexpr_end'>}</span><span class='tstring_content'>-</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_member'>member</span><span class='lbracket'>[</span><span class='symbol'>:primaryGroupId</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span>
<span class='id identifier rubyid_primary_group'>primary_group</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_get_object_by_sid'>adds_get_object_by_sid</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_primary_group_sid'>primary_group_sid</span><span class='rparen'>)</span>
<span class='kw'>yield</span> <span class='id identifier rubyid_primary_group'>primary_group</span> <span class='kw'>if</span> <span class='id identifier rubyid_primary_group'>primary_group</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_filters'>filters</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
<span class='id identifier rubyid_filters'>filters</span> <span class='op'>&lt;&lt;</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>objectClass=group</span><span class='tstring_end'>&quot;</span></span>
<span class='id identifier rubyid_filters'>filters</span> <span class='op'>&lt;&lt;</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>member</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_inherited'>inherited</span> <span class='op'>?</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>:1.2.840.113556.1.4.1941:</span><span class='tstring_end'>&#39;</span></span> <span class='op'>:</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_end'>&#39;</span></span><span class='embexpr_end'>}</span><span class='tstring_content'>=</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap_escape_filter'>ldap_escape_filter</span><span class='lparen'>(</span><span class='id identifier rubyid_member_dn'>member_dn</span><span class='rparen'>)</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span>
<span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span>
<span class='label'>base:</span> <span class='id identifier rubyid_base_dn'>base_dn</span> <span class='op'>||</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_base_dn'>base_dn</span><span class='comma'>,</span>
<span class='label'>controls:</span> <span class='lbracket'>[</span><span class='id identifier rubyid_adds_build_ldap_sd_control'>adds_build_ldap_sd_control</span><span class='rbracket'>]</span><span class='comma'>,</span>
<span class='label'>filter:</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>(&amp;</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_filters'>filters</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span> <span class='lbrace'>{</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>(</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid__1'>_1</span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>&quot;</span></span> <span class='rbrace'>}</span><span class='period'>.</span><span class='id identifier rubyid_join'><span class='object_link'><a href="../../../../top-level-namespace.html#join-instance_method" title="#join (method)">join</a></span></span><span class='embexpr_end'>}</span><span class='tstring_content'>)</span><span class='tstring_end'>&quot;</span></span><span class='comma'>,</span>
<span class='label'>return_result:</span> <span class='kw'>false</span>
<span class='rparen'>)</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_ldap_entry'>ldap_entry</span><span class='op'>|</span>
<span class='kw'>yield</span> <span class='id identifier rubyid_ldap_entry'>ldap_entry</span>
<span class='id identifier rubyid_results'>results</span> <span class='op'>+=</span> <span class='int'>1</span>
<span class='kw'>end</span>
<span class='kw'>unless</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_get_operation_result'>get_operation_result</span><span class='period'>.</span><span class='id identifier rubyid_code'>code</span> <span class='op'>==</span> <span class='int'>0</span>
<span class='id identifier rubyid_raise'>raise</span> <span class='tstring'><span class='tstring_beg'>&quot;</span><span class='tstring_content'>LDAP Error: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_get_operation_result'>get_operation_result</span><span class='period'>.</span><span class='id identifier rubyid_message'>message</span><span class='embexpr_end'>}</span><span class='tstring_end'>&quot;</span></span>
<span class='kw'>end</span>
<span class='id identifier rubyid_results'>results</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="adds_sd_grants_permissions?-instance_method">
#<strong>adds_sd_grants_permissions?</strong>(ldap, security_descriptor, matcher, test_sid: nil, self_sid: nil) &#x21d2; <tt>Boolean</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Determine if a security descriptor will grant the permissions identified by <strong>matcher</strong> to the <strong>test_sid</strong>.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>ldap</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Net/LDAP/Connection.html" title="Net::LDAP::Connection (class)">Net::LDAP::Connection</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The LDAP connection to use for querying.</p>
</div>
</li>
<li>
<span class='name'>security_descriptor</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSecurityDescriptor.html" title="Rex::Proto::MsDtyp::MsDtypSecurityDescriptor (class)">Rex::Proto::MsDtyp::MsDtypSecurityDescriptor</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>The security descriptor object to evaluate.</p>
</div>
</li>
<li>
<span class='name'>matcher</span>
<span class='type'>(<tt><span class='object_link'><a href="ActiveDirectory/SecurityDescriptorMatcher/Base.html" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::SecurityDescriptorMatcher::Base (class)">SecurityDescriptorMatcher::Base</a></span></tt>)</span>
&mdash;
<div class='inline'>
<p>An object that will match ACEs that allow or deny the desired permissions.</p>
</div>
</li>
<li>
<span class='name'>test_sid</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">Rex::Proto::MsDtyp::MsDtypSid</a></span></tt>)</span>
<em class="default">(defaults to: <tt>nil</tt>)</em>
&mdash;
<div class='inline'>
<p>The SID to check for access.</p>
</div>
</li>
<li>
<span class='name'>self_sid</span>
<span class='type'>(<tt><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">Rex::Proto::MsDtyp::MsDtypSid</a></span></tt>)</span>
<em class="default">(defaults to: <tt>nil</tt>)</em>
&mdash;
<div class='inline'>
<p>The SID of the object who owns the security_descriptor. This is typically the objectSid LDAP attribute and is used when the security descriptor references the special ‘SELF’ entity.</p>
</div>
</li>
</ul>
<p class="tag_title">Returns:</p>
<ul class="return">
<li>
<span class='type'>(<tt>Boolean</tt>)</span>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 304</span>
<span class='kw'>def</span> <span class='id identifier rubyid_adds_sd_grants_permissions?'>adds_sd_grants_permissions?</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_security_descriptor'>security_descriptor</span><span class='comma'>,</span> <span class='id identifier rubyid_matcher'>matcher</span><span class='comma'>,</span> <span class='label'>test_sid:</span> <span class='kw'>nil</span><span class='comma'>,</span> <span class='label'>self_sid:</span> <span class='kw'>nil</span><span class='rparen'>)</span>
<span class='kw'>unless</span> <span class='id identifier rubyid_test_sid'>test_sid</span>
<span class='id identifier rubyid_current_user'>current_user</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_get_current_user'>adds_get_current_user</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='rparen'>)</span>
<span class='id identifier rubyid_raise'>raise</span> <span class='const'>RuntimeError</span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>No SID was specified and the current user could not be identified.</span><span class='tstring_end'>&#39;</span></span><span class='rparen'>)</span> <span class='kw'>unless</span> <span class='id identifier rubyid_current_user'>current_user</span>
<span class='id identifier rubyid_test_sid'>test_sid</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_current_user'>current_user</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_test_member_sids'>test_member_sids</span> <span class='op'>=</span> <span class='kw'>nil</span>
<span class='id identifier rubyid_dacl_aces'>dacl_aces</span> <span class='op'>=</span> <span class='lbracket'>[</span><span class='rbracket'>]</span>
<span class='comment'># because deny entries take precedence, process them first
</span> <span class='id identifier rubyid_dacl_aces'>dacl_aces</span> <span class='op'>+=</span> <span class='id identifier rubyid_security_descriptor'>security_descriptor</span><span class='period'>.</span><span class='id identifier rubyid_dacl'>dacl</span><span class='period'>.</span><span class='id identifier rubyid_aces'>aces</span><span class='period'>.</span><span class='id identifier rubyid_select'>select</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_ace'>ace</span><span class='op'>|</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypAceType.html" title="Rex::Proto::MsDtyp::MsDtypAceType (class)">MsDtypAceType</a></span></span><span class='period'>.</span><span class='id identifier rubyid_deny?'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypAceType.html#deny%3F-class_method" title="Rex::Proto::MsDtyp::MsDtypAceType.deny? (method)">deny?</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='period'>.</span><span class='id identifier rubyid_header'>header</span><span class='period'>.</span><span class='id identifier rubyid_ace_type'>ace_type</span><span class='rparen'>)</span> <span class='rbrace'>}</span>
<span class='id identifier rubyid_dacl_aces'>dacl_aces</span> <span class='op'>+=</span> <span class='id identifier rubyid_security_descriptor'>security_descriptor</span><span class='period'>.</span><span class='id identifier rubyid_dacl'>dacl</span><span class='period'>.</span><span class='id identifier rubyid_aces'>aces</span><span class='period'>.</span><span class='id identifier rubyid_select'>select</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_ace'>ace</span><span class='op'>|</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypAceType.html" title="Rex::Proto::MsDtyp::MsDtypAceType (class)">MsDtypAceType</a></span></span><span class='period'>.</span><span class='id identifier rubyid_allow?'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypAceType.html#allow%3F-class_method" title="Rex::Proto::MsDtyp::MsDtypAceType.allow? (method)">allow?</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='period'>.</span><span class='id identifier rubyid_header'>header</span><span class='period'>.</span><span class='id identifier rubyid_ace_type'>ace_type</span><span class='rparen'>)</span> <span class='rbrace'>}</span>
<span class='id identifier rubyid_dacl_aces'>dacl_aces</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_ace'>ace</span><span class='op'>|</span>
<span class='comment'># Uncomment this if you need to debug ACE evaluation
</span> <span class='comment'># ldap_object = adds_get_object_by_sid(ldap, ace.body.sid)
</span> <span class='comment'># $stderr.puts &quot;ACE:&quot;
</span> <span class='comment'># $stderr.puts &quot; Type: #{Rex::Proto::MsDtyp::MsDtypAceType.name(ace.header.ace_type)}&quot;
</span> <span class='comment'># $stderr.puts &quot; Permissions: #{ace.body.access_mask.permissions.map(&amp;:to_s).join(&#39;, &#39;)}&quot;
</span> <span class='comment'># $stderr.write &quot; SID: #{ace.body.sid}&quot;
</span> <span class='comment'># $stderr.puts (ldap_object &amp;&amp; ldap_object[:sAMAccountName].first) ? &quot; (#{ldap_object[:sAMAccountName].first})&quot; : &quot;&quot;
</span> <span class='comment'># $stderr.puts &quot; Object: #{ace.body.object_type}&quot; if Rex::Proto::MsDtyp::MsDtypAceType.has_object?(ace.header.ace_type)
</span>
<span class='kw'>next</span> <span class='kw'>if</span> <span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_ignore_ace?'>ignore_ace?</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span>
<span class='kw'>case</span> <span class='id identifier rubyid_ace'>ace</span><span class='period'>.</span><span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_sid'>sid</span>
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#SECURITY_WORLD_SID-constant" title="Rex::Proto::Secauthz::WellKnownSids::SECURITY_WORLD_SID (constant)">SECURITY_WORLD_SID</a></span></span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span>
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#SECURITY_AUTHENTICATED_USER_SID-constant" title="Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID (constant)">SECURITY_AUTHENTICATED_USER_SID</a></span></span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span>
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#SECURITY_PRINCIPAL_SELF_SID-constant" title="Rex::Proto::Secauthz::WellKnownSids::SECURITY_PRINCIPAL_SELF_SID (constant)">SECURITY_PRINCIPAL_SELF_SID</a></span></span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span> <span class='kw'>if</span> <span class='id identifier rubyid_self_sid'>self_sid</span> <span class='op'>==</span> <span class='id identifier rubyid_test_sid'>test_sid</span>
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#SECURITY_CREATOR_OWNER_SID-constant" title="Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_OWNER_SID (constant)">SECURITY_CREATOR_OWNER_SID</a></span></span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span> <span class='kw'>if</span> <span class='id identifier rubyid_security_descriptor'>security_descriptor</span><span class='period'>.</span><span class='id identifier rubyid_owner_sid'>owner_sid</span> <span class='op'>==</span> <span class='id identifier rubyid_test_sid'>test_sid</span>
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#SECURITY_CREATOR_GROUP_SID-constant" title="Rex::Proto::Secauthz::WellKnownSids::SECURITY_CREATOR_GROUP_SID (constant)">SECURITY_CREATOR_GROUP_SID</a></span></span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span> <span class='kw'>if</span> <span class='id identifier rubyid_security_descriptor'>security_descriptor</span><span class='period'>.</span><span class='id identifier rubyid_group_sid'>group_sid</span> <span class='op'>==</span> <span class='id identifier rubyid_test_sid'>test_sid</span>
<span class='kw'>when</span> <span class='id identifier rubyid_test_sid'>test_sid</span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span>
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#SECURITY_LOCAL_SYSTEM_SID-constant" title="Rex::Proto::Secauthz::WellKnownSids::SECURITY_LOCAL_SYSTEM_SID (constant)">SECURITY_LOCAL_SYSTEM_SID</a></span></span>
<span class='comment'># the SECURITY_LOCAL_SYSTEM_SID won&#39;t be found if looked up in the next block and if it&#39;s not the SID we&#39;re checking for, it doesn&#39;t apply anyways so just skip it
</span> <span class='kw'>next</span>
<span class='kw'>else</span>
<span class='id identifier rubyid_ldap_object'>ldap_object</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_get_object_by_sid'>adds_get_object_by_sid</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_ace'>ace</span><span class='period'>.</span><span class='id identifier rubyid_body'>body</span><span class='period'>.</span><span class='id identifier rubyid_sid'>sid</span><span class='rparen'>)</span>
<span class='kw'>next</span> <span class='kw'>unless</span> <span class='id identifier rubyid_ldap_object'>ldap_object</span> <span class='op'>&amp;&amp;</span> <span class='id identifier rubyid_ldap_object'>ldap_object</span><span class='lbracket'>[</span><span class='symbol'>:objectClass</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>group</span><span class='tstring_end'>&#39;</span></span><span class='rparen'>)</span>
<span class='id identifier rubyid_member_sids'>member_sids</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_query_group_members'>adds_query_group_members</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_ldap_object'>ldap_object</span><span class='period'>.</span><span class='id identifier rubyid_dn'>dn</span><span class='comma'>,</span> <span class='label'>inherited:</span> <span class='kw'>false</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_member'>member</span><span class='op'>|</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_member'>member</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span> <span class='rbrace'>}</span>
<span class='kw'>if</span> <span class='id identifier rubyid_member_sids'>member_sids</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='id identifier rubyid_test_sid'>test_sid</span><span class='rparen'>)</span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span>
<span class='kw'>next</span>
<span class='kw'>end</span>
<span class='kw'>if</span> <span class='id identifier rubyid_test_member_sids'>test_member_sids</span><span class='period'>.</span><span class='id identifier rubyid_nil?'>nil?</span>
<span class='id identifier rubyid_test_obj'>test_obj</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_get_object_by_sid'>adds_get_object_by_sid</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_test_sid'>test_sid</span><span class='rparen'>)</span>
<span class='id identifier rubyid_test_member_sids'>test_member_sids</span> <span class='op'>=</span> <span class='id identifier rubyid_adds_query_member_groups'>adds_query_member_groups</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='comma'>,</span> <span class='id identifier rubyid_test_obj'>test_obj</span><span class='period'>.</span><span class='id identifier rubyid_dn'>dn</span><span class='comma'>,</span> <span class='label'>inherited:</span> <span class='kw'>true</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_member'>member</span><span class='op'>|</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp.html" title="Rex::Proto::MsDtyp (module)">MsDtyp</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/MsDtyp/MsDtypSid.html" title="Rex::Proto::MsDtyp::MsDtypSid (class)">MsDtypSid</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_member'>member</span><span class='lbracket'>[</span><span class='symbol'>:objectSid</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_first'>first</span><span class='rparen'>)</span> <span class='rbrace'>}</span><span class='period'>.</span><span class='id identifier rubyid_to_set'>to_set</span>
<span class='kw'>if</span> <span class='id identifier rubyid_test_obj'>test_obj</span><span class='lbracket'>[</span><span class='symbol'>:objectClass</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_content'>user</span><span class='tstring_end'>&#39;</span></span><span class='rparen'>)</span> <span class='op'>&amp;&amp;</span> <span class='id identifier rubyid_test_sid'>test_sid</span><span class='period'>.</span><span class='id identifier rubyid_rid'>rid</span> <span class='op'>!=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#DOMAIN_USER_RID_GUEST-constant" title="Rex::Proto::Secauthz::WellKnownSids::DOMAIN_USER_RID_GUEST (constant)">DOMAIN_USER_RID_GUEST</a></span></span>
<span class='id identifier rubyid_test_member_sids'>test_member_sids</span> <span class='op'>&lt;&lt;</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#SECURITY_AUTHENTICATED_USER_SID-constant" title="Rex::Proto::Secauthz::WellKnownSids::SECURITY_AUTHENTICATED_USER_SID (constant)">SECURITY_AUTHENTICATED_USER_SID</a></span></span>
<span class='id identifier rubyid_test_member_sids'>test_member_sids</span> <span class='op'>&lt;&lt;</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz.html" title="Rex::Proto::Secauthz (module)">Secauthz</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html" title="Rex::Proto::Secauthz::WellKnownSids (module)">WellKnownSids</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Secauthz/WellKnownSids.html#DOMAIN_ALIAS_SID_USERS-constant" title="Rex::Proto::Secauthz::WellKnownSids::DOMAIN_ALIAS_SID_USERS (constant)">DOMAIN_ALIAS_SID_USERS</a></span></span>
<span class='kw'>end</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_apply_ace!'>apply_ace!</span><span class='lparen'>(</span><span class='id identifier rubyid_ace'>ace</span><span class='rparen'>)</span> <span class='kw'>if</span> <span class='id identifier rubyid_member_sids'>member_sids</span><span class='period'>.</span><span class='id identifier rubyid_any?'>any?</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_member_sid'>member_sid</span><span class='op'>|</span> <span class='id identifier rubyid_test_member_sids'>test_member_sids</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='id identifier rubyid_member_sid'>member_sid</span><span class='rparen'>)</span> <span class='rbrace'>}</span>
<span class='kw'>end</span>
<span class='kw'>break</span> <span class='kw'>if</span> <span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_satisfied?'>satisfied?</span>
<span class='kw'>end</span>
<span class='id identifier rubyid_matcher'>matcher</span><span class='period'>.</span><span class='id identifier rubyid_matches?'>matches?</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
<div class="method_details ">
<h3 class="signature " id="is_active_directory?-instance_method">
#<strong>is_active_directory?</strong>(ldap) &#x21d2; <tt>Boolean</tt>
</h3><div class="docstring">
<div class="discussion">
<p>Query the remote server via the provided LDAP connection to determine if it’s an Active Directory LDAP server. More specifically, this ensures that it reports active directory capabilities and the whoami extension.</p>
</div>
</div>
<div class="tags">
<p class="tag_title">Parameters:</p>
<ul class="param">
<li>
<span class='name'>Net::LDAP::Connection</span>
<span class='type'></span>
&mdash;
<div class='inline'>
<p>ldap_connection</p>
</div>
</li>
</ul>
<p class="tag_title">Returns:</p>
<ul class="return">
<li>
<span class='type'>(<tt>Boolean</tt>)</span>
</li>
</ul>
</div><table class="source_code">
<tr>
<td>
<pre class="lines">
25
26
27
28
29
30
31
32
33
34
35
36
37
38</pre>
</td>
<td>
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/ldap/active_directory.rb', line 25</span>
<span class='kw'>def</span> <span class='id identifier rubyid_is_active_directory?'>is_active_directory?</span><span class='lparen'>(</span><span class='id identifier rubyid_ldap'>ldap</span><span class='rparen'>)</span>
<span class='id identifier rubyid_root_dse'>root_dse</span> <span class='op'>=</span> <span class='id identifier rubyid_ldap'>ldap</span><span class='period'>.</span><span class='id identifier rubyid_search'>search</span><span class='lparen'>(</span>
<span class='label'>ignore_server_caps:</span> <span class='kw'>true</span><span class='comma'>,</span>
<span class='label'>base:</span> <span class='tstring'><span class='tstring_beg'>&#39;</span><span class='tstring_end'>&#39;</span></span><span class='comma'>,</span>
<span class='label'>scope:</span> <span class='const'>Net</span><span class='op'>::</span><span class='const'>LDAP</span><span class='op'>::</span><span class='const'>SearchScope_BaseObject</span><span class='comma'>,</span>
<span class='label'>attributes:</span> <span class='qsymbols_beg'>%i[</span><span class='words_sep'> </span><span class='tstring_content'>supportedCapabilities</span><span class='words_sep'> </span><span class='tstring_content'>supportedExtension</span><span class='words_sep'> </span><span class='tstring_end'>]</span></span>
<span class='rparen'>)</span><span class='op'>&amp;.</span><span class='id identifier rubyid_first'>first</span>
<span class='kw'>return</span> <span class='kw'>false</span> <span class='kw'>unless</span> <span class='id identifier rubyid_root_dse'>root_dse</span><span class='lbracket'>[</span><span class='symbol'>:supportedCapabilities</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_map'>map</span><span class='lparen'>(</span><span class='op'>&amp;</span><span class='symbol'>:to_s</span><span class='rparen'>)</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='const'><span class='object_link'><a href="#LDAP_CAP_ACTIVE_DIRECTORY_OID-constant" title="Msf::Exploit::Remote::LDAP::ActiveDirectory::LDAP_CAP_ACTIVE_DIRECTORY_OID (constant)">LDAP_CAP_ACTIVE_DIRECTORY_OID</a></span></span><span class='rparen'>)</span>
<span class='kw'>return</span> <span class='kw'>false</span> <span class='kw'>unless</span> <span class='id identifier rubyid_root_dse'>root_dse</span><span class='lbracket'>[</span><span class='symbol'>:supportedExtension</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_include?'>include?</span><span class='lparen'>(</span><span class='const'>Net</span><span class='op'>::</span><span class='const'>LDAP</span><span class='op'>::</span><span class='const'>WhoamiOid</span><span class='rparen'>)</span>
<span class='kw'>true</span>
<span class='kw'>end</span></pre>
</td>
</tr>
</table>
</div>
</div>
</div>
<div id="footer">
Generated on Fri May 8 17:02:34 2026 by
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
0.9.37 (ruby-3.1.5).
</div>
</div>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink